# CVEs published 2026-06-03

151 CVEs were published on June 3, 2026: 8 critical, 63 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-8722](https://cve.now/CVE-2026-8722.md): Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections (CVSS 6.5, TEAM Net::Async::Statsd::Client)
- [CVE-2026-10783](https://cve.now/CVE-2026-10783.md): gradio-app gradio Audio Cache Key save\_audio\_to\_cache weak hash (CVSS 2.0, gradio-app gradio · gradio)
- [CVE-2026-10777](https://cve.now/CVE-2026-10777.md): ealpha072 Student-Management-System Administrative Backend config.php improper authentication (CVSS 6.9, ealpha072 Student-Management-System)
- [CVE-2026-10775](https://cve.now/CVE-2026-10775.md): sgl-project SGLang Cache data\_hash denial of service (CVSS 2.0, sgl-project SGLang · sglang)
- [CVE-2026-22055](https://cve.now/CVE-2026-22055.md): Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform (CVSS 5.3, NETAPP Active IQ OneCollect)
- [CVE-2026-22054](https://cve.now/CVE-2026-22054.md): Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to per (CVSS 5.3, NETAPP Active IQ Config Advisor)
- [CVE-2026-10771](https://cve.now/CVE-2026-10771.md): crmeb crmeb\_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery (CVSS 6.9, crmeb\_java)
- [CVE-2026-10766](https://cve.now/CVE-2026-10766.md): mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate\_dataframe\_hash weak hash (CVSS 2.0, mlrun)
- [CVE-2026-43924](https://cve.now/CVE-2026-43924.md): FOSSBilling has an open redirect via administrator-configured redirect targets (CVSS 4.8, FOSSBilling)
- [CVE-2026-40495](https://cve.now/CVE-2026-40495.md): FOSSBilling version exposed via asset cache buster (CVSS 6.9, FOSSBilling)
- [CVE-2026-44682](https://cve.now/CVE-2026-44682.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 7.3, Acronis DeviceLock DLP)
- [CVE-2026-42061](https://cve.now/CVE-2026-42061.md): Local privilege escalation due to excessive permissions assigned to child processes. (CVSS 7.3, Acronis DeviceLock DLP)
- [CVE-2026-50033](https://cve.now/CVE-2026-50033.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 7.3, Acronis DeviceLock DLP)
- [CVE-2026-44609](https://cve.now/CVE-2026-44609.md): Local privilege escalation due to EXE hijacking vulnerability. (CVSS 7.3, Acronis DeviceLock DLP)
- [CVE-2026-8888](https://cve.now/CVE-2026-8888.md): CVE-2026-8888 (CVSS 7.5, Securly Chrome Extension)
- [CVE-2026-8889](https://cve.now/CVE-2026-8889.md): CVE-2026-8889 (CVSS 7.5, Securly Chrome Extension)
- [CVE-2026-8881](https://cve.now/CVE-2026-8881.md): CVE-2026-8881 (CVSS 7.5, Securly Chrome Extension)
- [CVE-2026-8879](https://cve.now/CVE-2026-8879.md): CVE-2026-8879 (CVSS 7.5, Securly Chrome Extension)
- [CVE-2026-7888](https://cve.now/CVE-2026-7888.md): Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed\_classes restriction. (CVSS 8.4, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8878](https://cve.now/CVE-2026-8878.md): CVE-2026-8878 (CVSS 7.5, Securly Chrome Extension)
- [CVE-2026-8876](https://cve.now/CVE-2026-8876.md): CVE-2026-8876 (CVSS 7.3, Securly Chrome Extension)
- [CVE-2026-8874](https://cve.now/CVE-2026-8874.md): CVE-2026-8874 (CVSS 7.1, Securly Chrome Extension)
- [CVE-2026-45702](https://cve.now/CVE-2026-45702.md): OP-TEE has FF-A type confusion in SPMC tmem path that causes S-EL1 kernel panic (CVSS 4.4, OP-TEE optee\_os)
- [CVE-2026-45614](https://cve.now/CVE-2026-45614.md): OP-TEE vulnerable to ECDH private key recovery (CVSS 4.7, OP-TEE optee\_os)
- [CVE-2026-42839](https://cve.now/CVE-2026-42839.md): ERPNext 16.16.0 - Stored XSS in POS cart item rendering (CVSS 4.8, Frappe ERPNext)
- [CVE-2026-42840](https://cve.now/CVE-2026-42840.md): ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals (CVSS 5.1, Frappe ERPNext)
- [CVE-2019-25720](https://cve.now/CVE-2019-25720.md): Dräger SC Monitoring Devices DoS via Malformed Network Packet (CVSS 7.1, Dräger SC 6002XL · Dräger SC6802XL +3)
- [CVE-2026-40290](https://cve.now/CVE-2026-40290.md): OP-TEE has a Use-After-Free race in FF-A shared-memory teardown (CVSS 7.8, OP-TEE optee\_os)
- [CVE-2026-46273](https://cve.now/CVE-2026-46273.md): ibmveth: Disable GSO for packets with small MSS (CVSS 8.6, Linux)
- [CVE-2026-20230](https://cve.now/CVE-2026-20230.md): Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability (CVSS 8.6, KEV, Cisco Unified Communications Manager)
- [CVE-2026-20175](https://cve.now/CVE-2026-20175.md): Cisco Finesse File Inclusion Vulnerability (CVSS 6.1, Cisco Finesse)
- [CVE-2026-20233](https://cve.now/CVE-2026-20233.md): Cisco Webex Meetings Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Webex Meetings)
- [CVE-2026-46272](https://cve.now/CVE-2026-46272.md): coresight: tmc-etr: Fix race condition between sysfs and perf mode (no CVSS, Linux)
- [CVE-2026-46271](https://cve.now/CVE-2026-46271.md): wifi: ath12k: do WoW offloads only on primary link (CVSS 7.8, Linux)
- [CVE-2026-46270](https://cve.now/CVE-2026-46270.md): power: supply: rt9455: Fix use-after-free in power\_supply\_changed() (CVSS 8.4, Linux)
- [CVE-2026-46269](https://cve.now/CVE-2026-46269.md): pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree (no CVSS, Linux)
- [CVE-2026-46268](https://cve.now/CVE-2026-46268.md): PCI/P2PDMA: Fix p2pmem\_alloc\_mmap() warning condition (no CVSS, Linux)
- [CVE-2026-46267](https://cve.now/CVE-2026-46267.md): nfc: hci: shdlc: Stop timers and work before freeing context (no CVSS, Linux)
- [CVE-2026-46266](https://cve.now/CVE-2026-46266.md): inet: RAW sockets using IPPROTO\_RAW MUST drop incoming ICMP (CVSS 9.1, Linux)
- [CVE-2026-46265](https://cve.now/CVE-2026-46265.md): RDMA/hns: Fix WQ\_MEM\_RECLAIM warning (CVSS 7.5, Linux)
- [CVE-2026-46264](https://cve.now/CVE-2026-46264.md): drm/xe/pf: Fix sysfs initialization (CVSS 8.8, Linux)
- [CVE-2026-46263](https://cve.now/CVE-2026-46263.md): drm/amd/display: Fix out-of-bounds stream encoder index v3 (CVSS 7.8, Linux)
- [CVE-2026-46262](https://cve.now/CVE-2026-46262.md): ASoC: fsl\_xcvr: Revert fix missing lock in fsl\_xcvr\_mode\_put() (no CVSS, Linux)
- [CVE-2026-46261](https://cve.now/CVE-2026-46261.md): spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm\_fiu\_probe() (no CVSS, Linux)
- [CVE-2026-46260](https://cve.now/CVE-2026-46260.md): ipv6: Fix out-of-bound access in fib6\_add\_rt2node(). (CVSS 7.8, Linux)
- [CVE-2026-46259](https://cve.now/CVE-2026-46259.md): procfs: fix missing RCU protection when reading real\_parent in do\_task\_stat() (CVSS 7.8, Linux)
- [CVE-2026-46258](https://cve.now/CVE-2026-46258.md): gpio: cdev: Avoid NULL dereference in linehandle\_create() (no CVSS, Linux)
- [CVE-2026-46257](https://cve.now/CVE-2026-46257.md): clocksource/drivers/timer-sp804: Fix an Oops when read\_current\_timer is called on ARM32 platforms where the SP804 is not registered as the sched\_clock. (no CVSS, Linux)
- [CVE-2026-46256](https://cve.now/CVE-2026-46256.md): NFS/localio: prevent direct reclaim recursion into NFS via nfs\_writepages (no CVSS, Linux)
- [CVE-2026-46255](https://cve.now/CVE-2026-46255.md): dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (no CVSS, Linux)
- [CVE-2026-46254](https://cve.now/CVE-2026-46254.md): AppArmor: Allow apparmor to handle unaligned dfa tables (no CVSS, Linux)
- [CVE-2026-46253](https://cve.now/CVE-2026-46253.md): pstore/ram: fix buffer overflow in persistent\_ram\_save\_old() (CVSS 7.8, Linux)
- [CVE-2026-46252](https://cve.now/CVE-2026-46252.md): regulator: core: fix locking in regulator\_resolve\_supply() error path (no CVSS, Linux)
- [CVE-2026-46251](https://cve.now/CVE-2026-46251.md): btrfs: fix block\_group\_tree dirty\_list corruption (CVSS 8.4, Linux)
- [CVE-2026-46250](https://cve.now/CVE-2026-46250.md): MIPS: Work around LLVM bug when gp is used as global register variable (CVSS 7.3, Linux)
- [CVE-2026-46249](https://cve.now/CVE-2026-46249.md): octeontx2-af: Fix PF driver crash with kexec kernel booting (no CVSS, Linux)
- [CVE-2026-46248](https://cve.now/CVE-2026-46248.md): wifi: ath12k: clear stale link mapping of ahvif-\>links\_map (no CVSS, Linux)
- [CVE-2026-46247](https://cve.now/CVE-2026-46247.md): clk: qcom: gfx3d: add parent to parent request map (no CVSS, Linux)
- [CVE-2026-46246](https://cve.now/CVE-2026-46246.md): power: supply: pm8916\_lbc: Fix use-after-free for extcon in IRQ handler (no CVSS, Linux)
- [CVE-2026-46245](https://cve.now/CVE-2026-46245.md): drm/amd/display: Fix dc\_link NULL handling in HPD init (no CVSS, Linux)
- [CVE-2025-71314](https://cve.now/CVE-2025-71314.md): drm/panthor: Recover from panthor\_gpu\_flush\_caches() failures (no CVSS, Linux)
- [CVE-2025-71313](https://cve.now/CVE-2025-71313.md): PCI: endpoint: Add missing NULL check for alloc\_workqueue() (no CVSS, Linux)
- [CVE-2026-46244](https://cve.now/CVE-2026-46244.md): netfilter: nft\_inner: Fix IPv6 inner\_thoff desync (CVSS 9.1, Linux)
- [CVE-2026-42321](https://cve.now/CVE-2026-42321.md): GLPI has stored XSS in asset locks (CVSS 8.4, glpi-project glpi)
- [CVE-2026-42320](https://cve.now/CVE-2026-42320.md): GLPI vulnerable to arbitrary file access (CVSS 5.9, glpi-project glpi)
- [CVE-2026-42318](https://cve.now/CVE-2026-42318.md): GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint (CVSS 7.0, glpi-project glpi)
- [CVE-2026-42317](https://cve.now/CVE-2026-42317.md): GLPI vulnerable to arbitrary files deletion by technician (CVSS 7.0, glpi-project glpi)
- [CVE-2026-6657](https://cve.now/CVE-2026-6657.md): CORS Origin Validation Bypass in jupyter-server (CVSS 6.1, jupyter/jupyter · jupyter-server)
- [CVE-2022-31114](https://cve.now/CVE-2022-31114.md): backpack/crud Vulnerable to Cross-site Scripting (CVSS 5.1, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-3276](https://cve.now/CVE-2026-3276.md): Potential DoS via quadratic complexity in unicodedata.normalize() (CVSS 6.3, Python Software Foundation CPython)
- [CVE-2026-44281](https://cve.now/CVE-2026-44281.md): GLPI vulnerable to unauthorized reading of a specific asset object (CVSS 7.0, glpi-project glpi)
- [CVE-2024-47263](https://cve.now/CVE-2024-47263.md): An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Syn (CVSS 4.1, Synology Hyper Backup)
- [CVE-2024-47273](https://cve.now/CVE-2024-47273.md): An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyp (CVSS 4.3, Synology Hyper Backup)
- [CVE-2026-47325](https://cve.now/CVE-2026-47325.md): Weak password policy in ProjectsAndPrograms school-management-system (CVSS 6.9, ProjectsAndPrograms school-management-system)
- [CVE-2026-47324](https://cve.now/CVE-2026-47324.md): Stored XSS in Multiple Points in ProjectsAndPrograms school-management-system (CVSS 5.1, ProjectsAndPrograms school-management-system)
- [CVE-2022-49036](https://cve.now/CVE-2022-49036.md): An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Re (CVSS 7.8, Synology Active Backup for Business Recovery Media Creator)
- [CVE-2022-49042](https://cve.now/CVE-2022-49042.md): An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3. (CVSS 7.8, Synology Hyper Backup Explorer)
- [CVE-2026-44546](https://cve.now/CVE-2026-44546.md): Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofing (CVSS 3.7, djangoproject daphne · daphne)
- [CVE-2026-44545](https://cve.now/CVE-2026-44545.md): Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service (CVSS 5.3, djangoproject daphne · daphne)
- [CVE-2026-48587](https://cve.now/CVE-2026-48587.md): Potential exposure of private data via whitespace padding in Vary header (CVSS 3.1, djangoproject Django · django)
- [CVE-2026-35193](https://cve.now/CVE-2026-35193.md): Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware (CVSS 3.1, djangoproject Django · django)
- [CVE-2026-8404](https://cve.now/CVE-2026-8404.md): Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware (CVSS 3.1, djangoproject Django · django)
- [CVE-2026-7666](https://cve.now/CVE-2026-7666.md): Potential unencrypted email transmission via STARTTLS in the SMTP backend (CVSS 3.1, djangoproject Django · django)
- [CVE-2026-6873](https://cve.now/CVE-2026-6873.md): Signed cookie salt namespace collision in django.http.HttpRequest.get\_signed\_cookie (CVSS 3.1, djangoproject Django · django)
- [CVE-2023-52951](https://cve.now/CVE-2023-52951.md): A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle at (CVSS 5.9, Synology Note Station Client)
- [CVE-2026-10729](https://cve.now/CVE-2026-10729.md): HTML injection in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens (CVSS 1.2, Thinkst Applied Research Canarytokens)
- [CVE-2026-5241](https://cve.now/CVE-2026-5241.md): Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers (CVSS 8.0, huggingface/transformers · transformers)
- [CVE-2025-41259](https://cve.now/CVE-2025-41259.md): SWUpdate Untrusted Script Execution via Signed Update TOCTOU (CVSS 7.3, sbabic SWUpdate)
- [CVE-2026-10722](https://cve.now/CVE-2026-10722.md): cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflow (CVSS 4.8, cilium ebpf · github.com/cilium/ebpf)
- [CVE-2026-35085](https://cve.now/CVE-2026-35085.md): Stack buffer overflow in method gdv-serverconfig (CVSS 8.7, MBS Single-A · MBS Double-A Profibus +16)
- [CVE-2026-35084](https://cve.now/CVE-2026-35084.md): Stack buffer overflow in method dali-devconfig (CVSS 8.7, MBS Single-A · MBS Double-A Profibus +16)
- [CVE-2026-35083](https://cve.now/CVE-2026-35083.md): Stack buffer overflow in method bac-deviceobject (CVSS 8.7, MBS Single-A · MBS Double-A Profibus +16)
- [CVE-2026-35082](https://cve.now/CVE-2026-35082.md): Local file inclusion vulnerability and deletion in ugw-logread method (CVSS 8.7, MBS Single-A · MBS Double-A Profibus +16)
- [CVE-2026-35081](https://cve.now/CVE-2026-35081.md): Arbitrary process termination vulnerability in method ugw-logstop (CVSS 7.2, MBS Single-A · MBS Double-A Profibus +16)
- [CVE-2026-35080](https://cve.now/CVE-2026-35080.md): Arbitrary file delete vulnerability in method ugw-restoreinfo (CVSS 7.2, MBS Single-A · MBS Double-A Profibus +16)
- [CVE-2026-35079](https://cve.now/CVE-2026-35079.md): Arbitrary file delete vulnerability in method ugw-restore (CVSS 7.2, MBS Single-A · MBS Double-A Profibus +16)
- [CVE-2026-35078](https://cve.now/CVE-2026-35078.md): Arbitrary file delete vulnerability in method ugw-logstop (CVSS 7.2, MBS Single-A · MBS Double-A Profibus +16)
- [CVE-2026-35077](https://cve.now/CVE-2026-35077.md): Arbitrary file delete vulnerability in method ugw-delete-file (CVSS 7.2, MBS Single-A · MBS Double-A Profibus +16)
- [CVE-2026-35076](https://cve.now/CVE-2026-35076.md): Arbitrary file delete vulnerability in method bac-scanresult (CVSS 7.2, MBS Single-A · MBS Double-A Profibus +16)
- [CVE-2026-35075](https://cve.now/CVE-2026-35075.md): Hardcoded default Password for Service Account (CVSS 9.3, MBS Single-A · MBS Double-A Profibus +16)
- [CVE-2026-41032](https://cve.now/CVE-2026-41032.md): Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers (CVSS 7.5, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2025-14774](https://cve.now/CVE-2025-14774.md): Communication analysis between the Card Reader and TP2CardReaderService daemon (CVSS 7.4, ABB T-MAC Plus)
- [CVE-2025-14773](https://cve.now/CVE-2025-14773.md): Stored Cross-Site Scripting in ABB T-MAC Plus web application (CVSS 8.0, ABB T-MAC Plus)
- [CVE-2026-47065](https://cve.now/CVE-2026-47065.md): Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232 (CVSS 9.8, Apache Software Foundation Apache MINA · org.apache.mina:mi…)
- [CVE-2025-14772](https://cve.now/CVE-2025-14772.md): Broken Access Control in ABB T-MAC Plus web application (CVSS 8.8, ABB T-MAC Plus)
- [CVE-2025-14771](https://cve.now/CVE-2025-14771.md): File Disclosure in ABB T-MAC Plus web application and in ABB T-MAC plus Server - Default IIS Web Site (CVSS 9.9, ABB T-MAC Plus)
- [CVE-2025-15656](https://cve.now/CVE-2025-15656.md): WordPress School Management plugin \<= 93.2.0 - Privilege Escalation vulnerability (CVSS 8.8, Mojoomla School Management)
- [CVE-2025-15655](https://cve.now/CVE-2025-15655.md): WordPress School Management plugin \<= 93.2.0 - SQL Injection vulnerability (CVSS 7.6, Mojoomla School Management)
- [CVE-2025-15654](https://cve.now/CVE-2025-15654.md): WordPress Prague plugin \<= 2.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Fox-themes Prague)
- [CVE-2026-4035](https://cve.now/CVE-2026-4035.md): Environment Variable Resolution Vulnerability in mlflow/mlflow (CVSS 9.1, mlflow/mlflow · mlflow)
- [CVE-2026-5078](https://cve.now/CVE-2026-5078.md): morgan vulnerable to Log Forging via unneutralized control characters in :remote-user (CVSS 5.3, morgan)
- [CVE-2026-50052](https://cve.now/CVE-2026-50052.md): In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend requ (CVSS 2.3, The Vinyl Cache Project Vinyl Cache · The Vinyl Cache Pr… +1)
- [CVE-2026-50031](https://cve.now/CVE-2026-50031.md): ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. (CVSS 7.5, FreeIPMI)
- [CVE-2026-10705](https://cve.now/CVE-2026-10705.md): dask HLL hyperloglog.py nunique\_approx resource consumption (CVSS 2.3, dask)
- [CVE-2026-10704](https://cve.now/CVE-2026-10704.md): SourceCodester Pizzafy E-Commerce System Administrative Control Panel admin\_class\_novo.php login sql injection (CVSS 6.9, SourceCodester Pizzafy E-Commerce System)
- [CVE-2026-10703](https://cve.now/CVE-2026-10703.md): EIPStackGroup OpENer SendRRData cipmessagerouter.c CreateMessageRouterRequestStructure use after free (CVSS 5.3, EIPStackGroup OpENer)
- [CVE-2026-9516](https://cve.now/CVE-2026-9516.md): Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (CVSS 7.5, RURBAN Cpanel::JSON::XS)
- [CVE-2026-9334](https://cve.now/CVE-2026-9334.md): Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys\_as\_arrayref is enabled (CVSS 7.3, RURBAN Cpanel::JSON::XS)
- [CVE-2026-10694](https://cve.now/CVE-2026-10694.md): SourceCodester Online Food Ordering System index.php include file inclusion (CVSS 6.9, SourceCodester Online Food Ordering System)
- [CVE-2026-10693](https://cve.now/CVE-2026-10693.md): SourceCodester Online Boat Reservation System Administrative Endpoint improper authorization (CVSS 5.3, SourceCodester Online Boat Reservation System)
- [CVE-2025-60477](https://cve.now/CVE-2025-60477.md): A NULL pointer dereference in the gf\_filter\_pid\_resolve\_file\_template\_ex function (/filter\_core/filter\_pid.c) of GPAC Project/MP4Box before (CVSS 5.0)
- [CVE-2025-70100](https://cve.now/CVE-2025-70100.md): A divide-by-zero vulnerability in the ext4\_block\_set\_lb\_size function in src/ext4\_blockdev.c of the lwext4 1.0.0 library allows attackers to (CVSS 5.5)
- [CVE-2025-70101](https://cve.now/CVE-2025-70101.md): An out-of-bounds read in the ext4\_ext\_binsearch\_idx function in src/ext4\_extent.c of the lwext4 1.0.0 library allows attackers to cause a de (CVSS 6.5)
- [CVE-2026-26378](https://cve.now/CVE-2026-26378.md): Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via file upload function in I (CVSS 5.4)
- [CVE-2026-26379](https://cve.now/CVE-2026-26379.md): Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configuration. (CVSS 6.5)
- [CVE-2026-26824](https://cve.now/CVE-2026-26824.md): libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. (CVSS 6.5)
- [CVE-2026-26825](https://cve.now/CVE-2026-26825.md): A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. (CVSS 5.3)
- [CVE-2026-36460](https://cve.now/CVE-2026-36460.md): Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. (CVSS 4.8)
- [CVE-2026-36574](https://cve.now/CVE-2026-36574.md): A DLL hijacking vulnerability in Wassimulator (GitHub) CactusViewer v2.3.0 allows attackers to escalate privileges and execute arbitrary cod (CVSS 7.8)
- [CVE-2026-36576](https://cve.now/CVE-2026-36576.md): An OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas up to commit 9f50579 allows attackers to ex (CVSS 9.8)
- [CVE-2026-36602](https://cve.now/CVE-2026-36602.md): Mercusys AC12G (EU) V1 router with firmware AC12G(EU)\_V1\_200909 discloses kernel memory layout via the UPnP GetStatusInfo action. (CVSS 4.3)
- [CVE-2026-36603](https://cve.now/CVE-2026-36603.md): Mercusys AC12G (EU) V1 router with firmware AC12G(EU)\_V1\_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, inclu (CVSS 8.1)
- [CVE-2026-36604](https://cve.now/CVE-2026-36604.md): Mercusys AC12G (EU) V1 router with firmware AC12G(EU)\_V1\_200909 does not validate the HTTP Host header, enabling DNS rebinding attacks. (CVSS 6.5)
- [CVE-2026-36605](https://cve.now/CVE-2026-36605.md): Mercusys AC12G (EU) V1 router with firmware AC12G(EU)\_V1\_200909 is vulnerable to a HTTP denial of service via a low number of crafted incomp (CVSS 6.5)
- [CVE-2026-36606](https://cve.now/CVE-2026-36606.md): Mercusys AC12G (EU) V1 router with firmware AC12G(EU)\_V1\_200909 encrypts configuration backups with a hardcoded DES key using single DES in (CVSS 7.1)
- [CVE-2026-36607](https://cve.now/CVE-2026-36607.md): Mercusys AC12G (EU) V1 router with firmware AC12G(EU)\_V1\_200909 allows unauthenticated brute-force attacks via the TDDP password change endp (CVSS 8.8)
- [CVE-2026-36608](https://cve.now/CVE-2026-36608.md): Mercusys AC12G (EU) V1 router with firmware AC12G(EU)\_V1\_200909 allows UPnP AddPortMapping to forward external ports to the router's own adm (CVSS 8.8)
- [CVE-2026-36609](https://cve.now/CVE-2026-36609.md): Mercusys AC12G (EU) V1 router with firmware AC12G(EU)\_V1\_200909 uses a static authentication nonce that does not change between requests fro (CVSS 7.3)
- [CVE-2026-36610](https://cve.now/CVE-2026-36610.md): Mercusys AC12G (EU) V1 with firmware AC12G(EU)\_V1\_200909 transmits DDNS credentials over plaintext HTTP with only Base64 encoding. (CVSS 5.9)
- [CVE-2026-36611](https://cve.now/CVE-2026-36611.md): Mercusys AC12G (EU) V1 with firmware AC12G(EU)\_V1\_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAP (CVSS 7.3)
- [CVE-2026-36612](https://cve.now/CVE-2026-36612.md): Mercusys AC12G (EU) V1 with firmware AC12G(EU)\_V1\_200909 enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 a (CVSS 6.4)
- [CVE-2026-36613](https://cve.now/CVE-2026-36613.md): Mercusys AC12G (EU) V1 with firmware AC12G(EU)\_V1\_200909 returns 128 bytes of uninitialized internal buffer contents when receiving HTTP POS (CVSS 4.3)
- [CVE-2026-36615](https://cve.now/CVE-2026-36615.md): Mercusys AC12G (EU) V1 with firmware AC12G(EU)\_V1\_200909 exposes an undocumented /agileconfigreset endpoint that returns internal buffer con (CVSS 4.3)
- [CVE-2026-36616](https://cve.now/CVE-2026-36616.md): Mercusys AC12G (EU) V1 with firmware AC12G(EU)\_V1\_200909 contains hardcoded WiFi driver credentials including a RADIUS shared secret, WPS te (CVSS 5.9)
- [CVE-2026-36618](https://cve.now/CVE-2026-36618.md): Mercusys AC12G (EU) V1 with firmware AC12G(EU)\_V1\_200909 responds to version.bind CHAOS TXT queries, disclosing the DNS resolver software ve (CVSS 4.3)
- [CVE-2026-36748](https://cve.now/CVE-2026-36748.md): RockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile. (CVSS 9.0)
- [CVE-2026-37460](https://cve.now/CVE-2026-37460.md): Missing input validation in the rfapiRibBi2Ri() function (rfapi\_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cau (CVSS 7.5)
- [CVE-2026-37462](https://cve.now/CVE-2026-37462.md): An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service ( (CVSS 7.5, github.com/osrg/gobgp/v4)
- [CVE-2026-37700](https://cve.now/CVE-2026-37700.md): Cross Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via the Backend page file (CVSS 4.1)
- [CVE-2026-39107](https://cve.now/CVE-2026-39107.md): A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. (CVSS 6.3)
- [CVE-2026-46447](https://cve.now/CVE-2026-46447.md): OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver\_info or node.instance\_info (CVSS 5.8, OpenStack Ironic · ironic)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.